Pulse Secure 5.3.2(853) 1205 error on Windows 10 Ent 2016 LTSB with Symantec Endpoint Protection

[corkboard]

I know there are other posts on this but starting a separate one related to SEP 14.0.3876. On the same hardware/image with SEP that was giving the 1205 error, after uninstalling SEP and re-installing Pulse, I can now consistantly connect without the 1205 error and the JNVA stays in device manager after power downs, reboots, etc. Also noting that if Pulse is installed first, then SEP afterwards that the 1205 does not occur, though only tested this breifly thus far. Maybe SEP Teefer needs to know about the JNVA first, instead of the JNVA being installed after Teefer?

[Pretambey]

Hey,
We ran into this issue even without Symantec.
Try this on one of your affected machines.
1.) confirm pulse is giving 1205 error
2.) fix pulse secure and confirm it works
3.) go to Task Scheduler Local -> Task Scheduler Library -> Microsoft -> Windows -> rempl
4.) run both the tasks in that.
Your pulse client should now break again.
I was able to reproduce the issue with these steps as I saw the jnvra drivers from driver store were getting deleted. Pulse TAC helped us out on this. Try this if you have same issue.

[corkboard]

Thanks Pretambey. Just this morining my no-SEP machine gave the 1205, so like you've seen it does not appear to be SEP clobbering Pulse. Another check we did was with our Win7 boxes; same SEP/Pulse versions together and they have been and keep working perfectly. I'll try your suggestion and reply with reults, thanks.

[corkboard]

Okay Pretambey, I was able to reproduce this. The shell portion triggers at 10am every day, so I wonder if this is the only task messing with the driverstore. The shell-unlock is triggered on workstation lock/unlock but my test PC had been thru this many times and still Pulse worked. I'll mess with it more and post any findings.

[corkboard]

Found a workaround from link below to stop rempl, you may already know of it but it does work so far for me. I have 4023057 but remsh is still at 10019. The article below references 10020, but not sure how to get that.

https://support.microsoft.com/en-us/help/4098563/usb-device-drivers-are-removed-unexpectedly-after-w...

USB device drivers are removed unexpectedly after Windows 10 is updated

The applicability rules for the Windows update reliability tool have been improved. In addition, the latest version of this tool (10.0.14393.10020 or a later version) should not cause the issue.

As a workaround, you can completely block the update reliability tool from running. To do this, run the following commands:

takeown /f "C:\Program Files\rempl" /r /d y
icacls "C:\Program Files\rempl" /grant administrators:F /t /q
icacls "C:\Program Files\rempl" /deny system:F /t /q

[mspiers]

This is correct, https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB43717/ covers this issue with the Microsoft update adding a tool that removes the Pulse driver.